8Base ransomware operators use a new variant of the Phobos ransomware

8Base ransomware operators were observed using a variant of the Phobos ransomware in a recent wave of attacks. Cisco Talos researchers observed 8Base ransomware operators using a variant of the Phobos ransomware in recent attacks. Phobos variants are usually distributed by the SmokeLoader, but in 8Base campaigns, it has the ransomware component embedded in its encrypted payloads. The […]

November 19, 2023
Read More >>

Any hints about this challenge?

I have been working on hackthebox’s “Toxic” CTF challenge for 2 days and I’m now kinda stuck.

I realized if I decode the PHPSESSID and change the value to anything that will end with “Model” like “HelloModel” the program will include “Hellomodel.php”

“`

spl_autoload_register(function ($name){

if (preg_match(‘/Model$/’, $name))

{

$name = “models/${name}”;

}

include_once “${name}.php”;

});

“`

I first thought I should just use an space, like if the input of ‘include_once’ function is “flag Model.php” it would be okay. but apparently include_once function doesn’t have any separators. can someone give me a hint?

submitted by /u/Soroush_ra
[link] [comments]

November 19, 2023
Read More >>